pfSense

<?php

/*

 *	Copyright (c)  2004-2015  Electric Sheep Fencing, LLC. All rights reserved.

 *	Copyright (c)  2004, 2005 Scott Ullrich

 *	Copyright (c)  2010 Ermal Luçi

 *	Redistribution and use in source and binary forms, with or without modification,

 *	are permitted provided that the following conditions are met:

 *

 *	1. Redistributions of source code must retain the above copyright notice,

 *		this list of conditions and the following disclaimer.

 *

 *	2. Redistributions in binary form must reproduce the above copyright

 *		notice, this list of conditions and the following disclaimer in

 *		the documentation and/or other materials provided with the

 *		distribution.

 *

 *	3. All advertising materials mentioning features or use of this software

 *		must display the following acknowledgment:

 *		"This product includes software developed by the pfSense Project

 *		 for use in the pfSense software distribution. (http://www.pfsense.org/).

 *

 *	4. The names "pfSense" and "pfSense Project" must not be used to

 *		 endorse or promote products derived from this software without

 *		 prior written permission. For written permission, please contact

 *		 coreteam@pfsense.org.

 *

 *	5. Products derived from this software may not be called "pfSense"

 *		nor may "pfSense" appear in their names without prior written

 *		permission of the Electric Sheep Fencing, LLC.

 *

 *	6. Redistributions of any form whatsoever must retain the following

 *		acknowledgment:

 *

 *	"This product includes software developed by the pfSense Project

 *	for use in the pfSense software distribution (http://www.pfsense.org/).

 *

 *	THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY

 *	EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 *	IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 *	PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR

 *	ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 *	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 *	NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 *	LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 *	HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 *	STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 *	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 *	OF THE POSSIBILITY OF SUCH DAMAGE.

 *

 *	====================================================================

 *

 */

##|+PRIV

##|*IDENT=page-system-authservers

##|*NAME=System: Authentication Servers

##|*DESCR=Allow access to the 'System: Authentication Servers' page.

##|*MATCH=system_authservers.php*

##|-PRIV

require("guiconfig.inc");

if (isset($_POST['id']) && is_numericint($_POST['id'])) {

if ($act == "del") {

	if (!$a_server[$_GET['id']]) {

		pfSenseHeader("system_authservers.php");

		exit;

	}

	/* Remove server from temp list used later on this page. */

if ($act == "edit") {

	if (isset($id) && $a_server[$id]) {

		$pconfig['type'] = $a_server[$id]['type'];

		$pconfig['name'] = $a_server[$id]['name'];

		if ($pconfig['type'] == "ldap") {

			$pconfig['ldap_port'] = $a_server[$id]['ldap_port'];

			$pconfig['ldap_protver'] = $a_server[$id]['ldap_protver'];

			$pconfig['ldap_scope'] = $a_server[$id]['ldap_scope'];

			$pconfig['ldap_basedn'] = $a_server[$id]['ldap_basedn'];

			$pconfig['ldap_extended_query'] = $a_server[$id]['ldap_extended_query'];

			$pconfig['ldap_bindpw'] = $a_server[$id]['ldap_bindpw'];

			$pconfig['ldap_attr_user'] = $a_server[$id]['ldap_attr_user'];

			$pconfig['ldap_attr_group'] = $a_server[$id]['ldap_attr_group'];

			$pconfig['ldap_attr_member'] = $a_server[$id]['ldap_attr_member'];

			$pconfig['ldap_nostrip_at'] = isset($a_server[$id]['ldap_nostrip_at']);

		if ($pconfig['type'] == "radius") {

			$pconfig['radius_host'] = $a_server[$id]['host'];

			$pconfig['radius_auth_port'] = $a_server[$id]['radius_auth_port'];

			$pconfig['radius_acct_port'] = $a_server[$id]['radius_acct_port'];

			if ($pconfig['radius_auth_port'] &&

			}

			if (!$pconfig['radius_auth_port'] &&

		}

	}

}

if ($act == "new") {

	$pconfig['ldap_protver'] = 3;

	$pconfig['ldap_anon'] = true;

	$pconfig['radius_srvcs'] = "both";

	$pconfig['radius_acct_port'] = "1813";

if ($_POST) {

	unset($input_errors);

	$pconfig = $_POST;

	/* input validation */

	if ($pconfig['type'] == "ldap") {

			"name type ldap_host ldap_port " .

			"ldap_urltype ldap_protver ldap_scope " .

			"ldap_attr_user ldap_attr_group ldap_attr_member ldapauthcontainers");

			gettext("Descriptive name"),

			gettext("Type"),

			gettext("Hostname or IP"),

			gettext("Port value"),

			gettext("Transport"),

			gettext("Protocol version"),

			gettext("Search level"),

			gettext("User naming Attribute"),

			gettext("Group naming Attribute"),

			gettext("Group member attribute"),

			gettext("Authentication container"));

		if (!$pconfig['ldap_anon']) {

			$reqdfields[] = "ldap_binddn";

			$reqdfields[] = "ldap_bindpw";

			$reqdfieldsn[] = gettext("Bind Password");

	}

	if ($pconfig['type'] == "radius") {

		$reqdfields = explode(" ", "name type radius_host radius_srvcs");

			gettext("Descriptive name"),

			gettext("Type"),

			gettext("Hostname or IP"),

			gettext("Services"));

		if ($pconfig['radisu_srvcs'] == "both" ||

		if ($pconfig['radisu_srvcs'] == "both" ||

		if (!isset($id)) {

			$reqdfields[] = "radius_secret";

	}

		$to_field = "{$pconfig['type']}_timeout";

		if (isset($_POST[$to_field]) && !empty($_POST[$to_field]) && (!is_numeric($_POST[$to_field]) || (is_numeric($_POST[$to_field]) && ($_POST[$to_field] <= 0)))) {

			$input_errors[] = sprintf(gettext("%s Timeout value must be numeric and positive."), strtoupper($pconfig['type']));

		}

	if (isAjax() && is_array($input_errors)) {

		input_errors2Ajax($input_errors);

		exit;

	}

	if (!$input_errors) {

		$server = array();

		$server['refid'] = uniqid();

		$server['type'] = $pconfig['type'];

		$server['name'] = $pconfig['name'];

		if ($server['type'] == "ldap") {

			$server['ldap_port'] = $pconfig['ldap_port'];

			$server['ldap_urltype'] = $pconfig['ldap_urltype'];

			$server['ldap_protver'] = $pconfig['ldap_protver'];

			$server['ldap_scope'] = $pconfig['ldap_scope'];

			$server['ldap_basedn'] = $pconfig['ldap_basedn'];

			$server['ldap_extended_query'] = $pconfig['ldap_extended_query'];

			$server['ldap_attr_group'] = $pconfig['ldap_attr_group'];

			$server['ldap_attr_member'] = $pconfig['ldap_attr_member'];

			$server['ldap_attr_groupobj'] = empty($pconfig['ldap_attr_groupobj']) ? "posixGroup" : $pconfig['ldap_attr_groupobj'];

			if ($pconfig['ldap_nostrip_at'] == "yes") {

				$server['ldap_rfc2307'] = true;

			} else {

				unset($server['ldap_rfc2307']);

			}

			if (!$pconfig['ldap_anon']) {

				$server['ldap_binddn'] = $pconfig['ldap_binddn'];

				$server['ldap_bindpw'] = $pconfig['ldap_bindpw'];

			} else {

				unset($server['ldap_binddn']);

				unset($server['ldap_bindpw']);

			}

			if ($pconfig['ldap_timeout']) {

				$server['ldap_timeout'] = $pconfig['ldap_timeout'];

			} else {

				$server['ldap_timeout'] = 25;

			}

		if ($server['type'] == "radius") {

			$server['host'] = $pconfig['radius_host'];

				$server['radius_auth_port'] = $pconfig['radius_auth_port'];

				$server['radius_acct_port'] = $pconfig['radius_acct_port'];

			}

			if ($pconfig['radius_srvcs'] == "auth") {

				$server['radius_auth_port'] = $pconfig['radius_auth_port'];

				unset($server['radius_acct_port']);

			}

			if ($pconfig['radius_srvcs'] == "acct") {

				$server['radius_acct_port'] = $pconfig['radius_acct_port'];

				unset($server['radius_auth_port']);

			}

		}

		write_config();

		pfSenseHeader("system_authservers.php");

	}

}

	$pconfig = $_POST;

	$pconfig['ldap_authcn'] = $_POST['ldapauthcontainers'];

	print_input_errors($input_errors);

$tab_array = array();

$tab_array[] = array(gettext("Users"), false, "system_usermanager.php");

$tab_array[] = array(gettext("Groups"), false, "system_groupmanager.php");

$tab_array[] = array(gettext("Settings"), false, "system_usermanager_settings.php");

$tab_array[] = array(gettext("Servers"), true, "system_authservers.php");

display_top_tabs($tab_array);

if (!($act == "new" || $act == "edit" || $input_errors))

{

	?>

		<table class="table table-striped table-hover">

			<thead>

				<tr>

					<th><?=gettext("Server Name")?></th>

					<th><?=gettext("Type")?></th>

					<th><?=gettext("Host Name")?></th>

			</thead>

			<tbody>

		<?php foreach($a_server as $i => $server): ?>

				<tr>

					<td><?=htmlspecialchars($server['name'])?></td>

					<td><?=htmlspecialchars($auth_server_types[$server['type']])?></td>

					<td><?=htmlspecialchars($server['host'])?></td>

					<td>

					<?php if ($i < (count($a_server) - 1)): ?>

					</td>

				</tr>

		<?php endforeach; ?>

			</tbody>

		</table>

	</div>

		</a>

	exit;

$form->setAction('system_authservers.php?act=edit');

	'userid',

	null,

	'hidden',

	$id

));

$section = new Form_Section('Server settings');

$section->addInput($input = new Form_Input(

	'name',

	'Descriptive name',

	'text',

	$pconfig['name']

));

$section->addInput($input = new Form_Select(

	'type',

	'Type',

	$pconfig['type'],

	$auth_server_types

$form->add($section);

// ==== LDAP settings =========================================================

if (!isset($pconfig['type']) || $pconfig['type'] == 'ldap')

	$section->addClass('in');

$section->addInput(new Form_Input(

	'ldap_host',

	'Hostname or IP address',

	'text',

	$pconfig['ldap_host']

))->setHelp('NOTE: When using SSL, this hostname MUST match the Common Name '.

$section->addInput(new Form_Input(

	'ldap_port',

	'Port value',

	'number',

	$pconfig['ldap_port']

));

$section->addInput(new Form_Select(

	'ldap_urltype',

	'Transport',

	$pconfig['ldap_urltype'],

	array_combine(array_keys($ldap_urltypes), array_keys($ldap_urltypes))

));

if (empty($a_ca))

{

	$section->addInput(new Form_StaticText(

		'Peer Certificate Authority',

		'No Certificate Authorities defined.<br/>Create one under <a href="system_camanager.php">System &gt; Cert Manager</a>.'

	));

{

	$ldapCaRef = [];

	foreach ($a_ca as $ca)

		$ldapCaRef[ $ca['refid'] ] = $ca['descr'];

	$section->addInput(new Form_Select(

		'ldap_caref',

		'Peer Certificate Authority',

		$pconfig['ldap_caref'],

		$ldapCaRef

	))->setHelp('This option is used if \'SSL Encrypted\' option is choosen. '.

		'It must match with the CA in the AD otherwise problems will arise.');

	'ldap_protver',

	'Protocol version',

	$pconfig['ldap_protver'],

	array_combine($ldap_protvers, $ldap_protvers)

));

	'ldap_timeout',

	'Server Timeout',

	'number',

	$pconfig['ldap_timeout'],

	['placeholder' => 25]

))->setHelp('Timeout for LDAP operations (seconds)');

	$ldap_scopes

	'Base DN',

	'text',

	$pconfig['ldap_basedn']

$section->addInput(new Form_StaticText(

	'Search scope',

	'Level ' . $SSF . '<br />' . 'Base DN' . $SSB

));

$group = new Form_Group('Authentication containers');

$group->add(new Form_Input(

	'ldapauthcontainers',

	'Containers',

	'text',

	$pconfig['ldap_authcn']

))->setHelp('Note: Semi-Colon separated. This will be prepended to the search '.

	'base dn above or you can specify full container path containing a dc= '.

	'component.<br/>Example: CN=Users;DC=example,DC=com or OU=Staff;OU=Freelancers');

	'Select',

))->removeClass('btn-primary')->addClass('btn-default');

	'Enable extended query',

	'ldap_extended_query',

	$pconfig['ldap_extended_query']

$section->addInput(new Form_Checkbox(

	'ldap_anon',

	'Bind anonymous',

	'Use anonymous binds to resolve distinguished names',

	$pconfig['ldap_anon']

$group = new Form_Group('Bind credentials');

	'ldap_binddn',

	'User DN:',

	'text',

	$pconfig['ldap_binddn']

));

	'ldap_bindpw',

	'Password',

	'text',

	$pconfig['ldap_bindpw']

));

$section->add($group);

	$template_list = array();

	foreach($ldap_templates as $option => $template) {

		$template_list[$option] = $template['desc'];

	}

	$section->addInput(new Form_Select(

		'ldap_tmpltype',

		'Initial Template',

		$pconfig['ldap_template'],

	'ldap_attr_user',

	'User naming attribute',

	'text',

	$pconfig['ldap_attr_user']

));

$section->addInput(new Form_Input(

	'ldap_attr_group',

	'Group naming attribute',

	'text',

	$pconfig['ldap_attr_group']

));

$section->addInput(new Form_Input(

	'ldap_attr_member',

	'Group member attribute',

	'text',

	$pconfig['ldap_attr_member']

));

	'ldap_rfc2307',

	'RFC 2307 Groups',

	'LDAP Server uses RFC 2307 style group membership',

	$pconfig['ldap_rfc2307']

))->setHelp('RFC 2307 style group membership has members listed on the group '.

	'object rather than using groups listed on user object. Leave unchecked '.

	'for Active Directory style group membership (RFC 2307bis).');

$section->addInput(new Form_Input(

	'ldap_attr_groupobj',

	'Group Object Class',

	'text',

	$pconfig['ldap_attr_groupobj'],

	['placeholder' => 'posixGroup']

))->setHelp('Object class used for groups in RFC2307 mode. '.

	'Typically "posixGroup" or "group".');

	'ldap_utf8',

	'UTF8 Encode',

	'UTF8 encode LDAP parameters before sending them to the server.',

	$pconfig['ldap_utf8']